Medical products. Software with increased requirements.

The Medical Product Law [Medizinproduktgesetz] in Germany is supplemented by the following regulations:

There are several distinctions made for software in medical contexts:

• software as part of a medical product, e.g. as embedded software in a medical device
• software as a standalone medical product
• Software as an accessory to a medical product
• independent software that is not a medical product

The purpose as determined by the manufacturer is decisive here. However, because this regulation is a bit vague, the Medical Device Coordination Group (MDCG) has developed a new definition of Medical Device Software (MDSW). Software as a medical device is according to this definition both software that works independently and software that makes the device work or influences its use.

Medical products are divided into active implants (RL 90/385/EEC) e.g. pacemakers, in-vitro diagnostics (RL 98/79/EC) e.g. HIV tests and medical devices (RL 93/42/EEC) e.g. dialysis equipment. The latter are in turn classified according to risk.

Class I:Low risk, these are divided into two groups (sterile and with measuring function). Examples: medical apps, wheelchairs, glasses, thermometers, etc.

Class IIa: Medium risk. Examples: Dental fillings, X-ray films, hearing aids, ultrasound equipment etc.

Class IIb: High risk. Examples: Intraocular lenses, condoms, X-ray equipment, infusion pumps, etc.

Class III: Very high risk. Examples: Hip and knee joint replacements, heart catheters, breast implants etc.

Classification is based on whether the product is invasive, how and for how long it is used, whether it is an active product and whether it is used on vital organs. There are currently 18 rules for the assignment to classes. Rule 11 has so far resulted in stand-alone software falling into class I. However, in the MDR rule 11 for software was modified. When software is used for diagnostic or therapeutic purposes (and this is likely always to be the case), it will in future be assigned to Class IIb or even III, depending on the risk (death or irreversible change in health status).

Norm IEC 62304 names five software life cycle processes:

1. software development process
2. software maintenance process
3. software risk management process
4. software configuration management process
5. problem solving process for software

The software development process is divided into eight sequential steps:

Depending which safety class the software falls under, different steps in the process must be executed and documented. IEC 62304 provides for three classes of software:

Class A Injuries or damage to health cannot occur through the use of the software.

Class B Serious injuries cannot occur by using the software.

Class C Injuries including death are possible as a result of using the software.

Since 2015 there is an addendum to the standard, in which software system tests are mandatory for all classes. As far as quality and risk management in software development is concerned, this standard refers to the respective specialized standards ISO 13485 and ISO 14971. For software maintenance there is a similar plan with eight steps.

The standard for quality assurance of medical devices ISO 13485 is in many parts identical with the widely known quality management standard ISO 9001. The central requirement is the documentation of all processes in a quality management manual. This document also provides the basis for proof of conformity. Four process groups are defined in ISO 13485:

1. Management responsibility for defining quality objectives and monitoring the effectiveness of the quality management system.
2. Resource management (people, financial resources and equipment).
3. Product realization including development and production.
4. The process of continuous analysis and improvement.

Diese Prozesse sollen dazu führen, die Anforderungen für regulatorische Zwecke vollständig zu erfüllen. Die Norm zielt in erster Linie auf die Sicherheit der Medizinprodukte ab, während die ISO 9001 darauf ausgerichtet ist, dass Organisationen eine kontinuierliche Verbesserung anstreben.

These processes were created to ensure full compliance with the requirements for regulatory purposes. ISO 13485 is primarily aimed at the safety of medical devices, while ISO 9001 is designed to ensure that organizations strive for continuous improvement.

DIN ISO 14971 describes a risk management process for medical products. The aim is to minimize the risks for patients, users and third parties and to establish an acceptable risk-benefit ratio. The third edition of the standard, which will be published in 2019, emphasizes even more strongly that the benefits of a medical device must outweigh the risks. To this end, benefit was precisely redefined as:

positive effect or desirable outcome of the use of a medical device on the health of a person or positive impact on patient management or public health

Benefit is thus clearly defined as the medical benefit, not the economic benefit for the manufacturer.

The risk management process includes both risk analysis and risk management. This process is also divided into several steps:

1. Determination of general requirements for the risk management system
2. Risk analysis
3. Risk Assessment
4. Risk management
5. Evaluation of the total residual risk
6. Review of risk management
7. Continuous risk analysis and verification of risk acceptance in production and post-production